An adversarial wrap hid a Toyota from Flock cameras after 31 million tests

Anti-surveillance clothing stopped being an art project. A machine-generated pattern made a car invisible to Flock cameras, and it took 31 million tests to get there.

How the patterns were built

Security researcher Bill Swearingen built a reinforcement learning system called noRecognition that generates adversarial patterns. He describes the process as teaching the model how to paint: each time a pattern failed and a detection algorithm caught it, the model tried again. After 31 million tests, the system produced patterns that defeated all 11 open source detection algorithms he tested, including the ones behind Flock license plate readers, Axon body cameras and Clearview AI.

The distinction that matters is where the attack lands. The pattern does not stop you from being recorded. It attacks the software layer that processes the video and decides what is a face, an object or a license plate. The camera still sees. It just stops understanding.

The Def Con demonstration

At Def Con 2026, Swearingen worked with Donut Media to wrap a 2009 Toyota Yaris in one of the patterns and drive it past a Flock camera. “We proved it was effective,” he told TechCrunch.

He is now crowdfunding t-shirts and hoodies printed with the patterns, with vehicle wraps possibly to follow. Notably, he is keeping his strongest patterns offline, on the reasoning that surveillance companies cannot study and defeat what they cannot see.

The arms race built into the product

The caveat worth naming is structural. Adversarial patterns are a moving target: every pattern that gets published is one the other side can add to its training data and learn to ignore. That is presumably why the strongest patterns stay private, but it also defines the product’s shelf life. A shirt that defeats today’s detectors is a data point for tomorrow’s.

What the demonstration establishes is narrower and still significant: the detection layer that automated surveillance depends on can be defeated by consumer-grade means, systematically, and at the cost of compute rather than expertise.